Python SQL query script?

[KieuVanQuan]

Here's a .py script:

 

print "Content-Type: text/html\n"

#print "<result>Success<resultcode>0";

arguments = cgi.FieldStorage()

for i in arguments.keys():
	if i == "userpassword":
		password=arguments[i].value
	if i == "userid":
		userid=arguments[i].value
	if i == "useripaddress":
		useripaddress=arguments[i].value
		
#print "The user %s is trying to login with pass %s" % (userid,password)

#Search the user into the DB table
querystring="select COUNT(userid) as ucount from NineDragons_Account.dbo.Tbl_Member_Password where userid='%s' and userpassword='%s'" % (userid,password)
cur.execute(querystring)
rows = cur.fetchall()
usercount=rows[0].ucount
if usercount != 1:
	print "<result>Failure<resultcode>127";
	
else:
	print "<result>Success<resultcode>0";
	
cur.close()
sys.exit(0)

if userid == "%s"
	print "<result>Success<resultcode>0";

print "<br>END SCRIPT<br>"

 

Here's what it does:

it connects to MSSQL and then inside MSSQL to a specific table then selects 'userid' and 'userpassword' and then somehow combines them? Not sure....

There are two resultcodes and one of them is sent to the login server and depending on the resultcode it either lets you log in or keeps you locked out because you've provided wrong credentials.

 

Question is:

How do I alter this code so that I can use any 'userid'? I mean I want to modify this code so I can log in with any 'userid' of my desire even if that 'userid' does not exist in the database.

 

For example:

This 'userid' exists in database: admin1

Then I type this to login id field (on my client): dijocdoisacjio  (a random set of characters) and then it lets me in even though it does not exist in the DB. How can I do this?

 

I tried removing the condition itself but it crashed the login server.

 

(I already stripped off the password requirement so it lets me in with any password)

Here's how I did it:

 

print "<result>Success";#<resultcode>0";

 

If I type this under the !=1 then I can log in with any password but I still have to provde the correct 'userid' otherwise on my client it says login failed.

 

It is my own server, I just want to get into an older DB.

 

Can anyone help me?